The Zephyr virtio driver fails to validate the descriptor-chain head id that the virtio device writes into the used ring. In the function virtio_isr() (drivers/virtio/virtio_common.c), the device-provided vq->used->ring[idx].id is used directly as an index into arrays vq->recv_cbs[] and vq->desc[], each allocated with exactly vq->num entries. Because the id is treated as a 16-bit value without bounds checking, a malicious or compromised virtio backend (such as an untrusted hypervisor or hardware device on PCI or MMIO transport) can supply an id beyond vq->num. This causes an out-of-bounds read of a function pointer and argument pair from heap memory beyond recv_cbs[], and the driver then calls this attacker-shaped pointer in the guest's interrupt context. This results in a control-flow hijack primitive that can lead to arbitrary code execution or a crash. The vulnerability affects Zephyr versions 4.2.0 and all versions from 4.2.0 up to but excluding 4.4.2 when built with CONFIG_VIRTIO using PCI or MMIO transport. The fix involves rejecting any used-ring id greater than or equal to vq->num before indexing or invoking callbacks.

An attacker controlling the virtio backend (such as an untrusted hypervisor or device) can trigger an out-of-bounds read and execute an attacker-influenced function pointer call within the Zephyr guest's interrupt context. This can lead to arbitrary code execution or a reliable crash. No privileges or user interaction are required on the guest side, making this a serious risk in environments where the virtio backend is not fully trusted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects any used-ring id greater than or equal to vq->num before indexing or invoking callbacks, which mitigates the vulnerability. Until an official patch or update is applied, avoid running untrusted virtio backends or isolate the affected Zephyr builds. Monitor vendor communications for an official fix.